Kyushu Electric Power Co., Inc. disclosed a physical security incident that exposed the private data of more than 10 million customers. The breach involved the loss of a storage drive containing sensitive information, marking a significant data security event for the Japanese energy sector.
The compromised data affects over 10.9 million clients, though the full scope of exposed information is still being assessed. The incident highlights vulnerabilities in physical data storage practices, even as organizations prioritize digital security.
The attack vector was physical — a storage drive was lost or stolen — rather than a remote cyber intrusion. Specific indicators of compromise or exploitation mechanisms have not been detailed by the company.
Kyushu Electric has not yet announced specific patches or remediation beyond the recovery effort. The firm is likely reviewing its physical security protocols and data handling procedures to prevent recurrence.
Attribution for the incident remains unclear, and no threat group has claimed responsibility. The breach underscores the ongoing risk of physical data theft in critical infrastructure sectors, where legacy storage methods may still be in use.